diff --git a/.github/workflows/pypi-publish.yml b/.github/workflows/pypi-publish.yml
index a335da3..69c5859 100644
--- a/.github/workflows/pypi-publish.yml
+++ b/.github/workflows/pypi-publish.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install uv
         uses: astral-sh/setup-uv@v10.1.0
diff --git a/.github/workflows/semantic-release.yml b/.github/workflows/semantic-release.yml
index d15daf0..90f8e8e 100644
--- a/.github/workflows/semantic-release.yml
+++ b/.github/workflows/semantic-release.yml
@@ -26,14 +26,14 @@ jobs:
       version: ${{ steps.semantic.outputs.new_release_version }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           # semantic-release walks back to the previous tag to decide the bump,
           # so a shallow clone makes it compute the wrong version.
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 22
 
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 7afe010..a56127b 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -4,9 +4,9 @@ defaults:
   run:
     shell: bash
 
+# Only on pull requests: main only changes through squash-merged PRs, which
+# have already passed these checks.
 on:
-  push:
-    branches: [ "main" ]
   pull_request:
     branches: [ "main" ]
 
@@ -19,7 +19,7 @@ jobs:
         os: ["ubuntu-latest", "windows-latest", "macos-latest"]
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Install uv
       uses: astral-sh/setup-uv@v10.1.0
       with:
@@ -30,7 +30,7 @@ jobs:
     - name: Run tests
       run: uv run pytest --cov --cov-report=xml --junitxml=tests.xml
     - name: Test Report
-      uses: dorny/test-reporter@v1
+      uses: dorny/test-reporter@v3
       if: success() || failure()
       with:
         name: Test Results (Python version ${{ matrix.python-version }})
@@ -43,7 +43,7 @@ jobs:
         python-version: [ "3.12" ]
     runs-on: "ubuntu-latest"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Install uv
         uses: astral-sh/setup-uv@v10.1.0
         with:
@@ -73,7 +73,7 @@ jobs:
         python-version: [ "3.12" ]
     runs-on: "ubuntu-latest"
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Install uv
         uses: astral-sh/setup-uv@v10.1.0
         with: